Filtering the Log Monitor Table

The filter bar allows you to filter the log table based on selected criteria.

1	Select a filter item by clicking on the desired column cell. The selected cell turns blue. Multiple cells can be selected.

2	When finished making selections, click the + in the filter bar.

The filter criteria is applied to the display, and you see the filter type in the filter bar.

3	Click on the arrow , beside the column name (in this case Category), to view the filter value.

4	To remove a filter, click the x next to the Filter type.

Filter View

Filter View allows you to set the filtering without any existing matches in the Log Monitor table.

In normal view, you can only set filtering based on an existing event that you can select in the Log Monitor table. In Filter View, you can select only one combination of Category/Priority at a time. In normal view, you can select several categories at the same time.

You can configure multiple filter views for categories using the filter bar.

To configure a filter view:

1	Go to the Log > Monitor page.

2	Click the + sign next to the Filter View bar. The Filter View dialog appears.

3	From the Priority menu, select the priority that you want.

4	From the Category menu, select the category that you want.

5	From the Source Interface menu, select the interface that you want.

6	From the Destination Interface menu, select the interface that you want.

7	In the Source IP box, enter the IP address of the source interface.

8	In the Destination IP box, enter the IP address of the destination interface.

9	Click Apply. The Log Monitor table displays the filtered results.

Log Event Messages

For a complete reference guide of log event messages, refer to the SonicOS Log Event Reference Guide at www.sonicwall.com/support.html.

Log Persistence

Lower end TZ models can store up to 800 event entries in the log buffer. All other Dell/Dell SonicWALL Release 6.2 models can store 1000 to 10,000 event entries in the log buffer.

When the log becomes full, one or a couple of the oldest log entries are deleted. You can also click the Clear all logs button to clear all log entries.

Emailing provides a simple version of logging persistence, while GMS provides a more reliable and scalable method.

The option to deliver logs as either plain-text or HTML provides an easy method to review and replay events logged.

GMS

To provide the ability to identify and view events across an entire enterprise, a GMS update will be required. Device-specific interesting-content events at the GMS console appear in Reports > Log Viewer Search page, but are also found throughout the various reports, such as Top Intrusions Over Time.